coen252computerforensics-資料下載頁(yè)
2024-10-24 17:55本頁(yè)面
【導(dǎo)讀】Freeware.rules.discarded.Otherwise,theyarelogged.analert.ForensicUse:. Intrusionshave“signatures”。Examples. with“../../”.CodeRedWorm2020. Footprint:. /?signature.analert.IDS?Firewall. IDScantakeitstime.alertsandlogs.HostbasedIDS(atallhosts). DistributedIDS(throughoutthelocal. Sniffer. Preprocessor. DetectionEngine. AlertLogging. PacketSniffer. Tapsintowork. Preprocessor. RPCplug-in. Portscannerplug-in. DetectionEngine. Rules. Actiontotake. Typeofpacket. Andruleoption. SnortAlerting. Ining“interestingpackets”aresent. tologfiles.PacketDecodeEngine. higherprotocols.foralerts.DetectionEngine. rulesfiles.DetectionPlug-Ins. OutputPlug-Ins
【正文】 Orifice [**] 05/1008:44: :60256 :31337 UDP TTL:41 TOS:0x0 ID:49951 Len: 8 Rule: Log: Snort Rules ? Rule Options ? Logto Option ? Specifies filename to which to log the activity. ? Allows to separate the annoyances from the truly dangerous. alert udp any any / 24 31335 \ (msg: “trinoo port”。 logto “DDoS”) Snort Rules ? Rule Options ? TTL option ? Allows to use the time to live field in packet ? Format: ttl: number alert udp any any / 24 33000。34000 \ (msg: “Unix traceroute”。 ttl: 1。) Snort Rules ? Rule Options ? ID option ? 16bit value found in the IP header of each datagram. alert udp any any / 24 33000。34000 \ (msg: “Suspicious IP Identification”。 ID: 0。) Snort Rules ? Rule Options ? Dsize option ? Size of payload alert icmp any any / 24 any \ (msg: “Large ICMP payload”。 dsize: 1024。) Snort Rules ? Rule Options ? Sequence Option ? Value of tcp sequence number ? Ack option ? Value of ack number in tcp alert tcp any any any any \ (msg: “Possible Shaft DDoS”。 seq: 0x28374839。) alert tcp any any any any \ (msg: “nmap tcp ping”。 flags: A。 ack: 0。) Snort Rules ? Rule Options ? Itype and Icode Options ? Select ICMP message type and operations code alert icmp / 24 any \ (msg: “port unreachable”。 itype: 3。 icode: 3。) Snort Rules ? Rule Options ? Flags option alert tcp any any any any \ (msg: “null scan”。 flags: 0。) Snort Rules ? Rule Options ? Content Option alert udp $EXTERNAL_NET any $HOME_NET 53 \ (msg: “Exploit bind tsig Overflow attempt”。 \ content: “|00 FA 00 FF|”。 content: “/bin/sh”。) Snort Rules ? Rule Options ? Offset option ? Specifies offset of content ? Depth option ? Specifies how far into packet to search for content ? Nocase option ? Makes content searches case insensitive ? Regex Option ? Allows wildcards in content searches Snort Rules ? Rule Options ? Session Options ? Allows to capture TCP session. ? Rest Option ? Allows an automatic active response ? Tag Option ? Allows to dynamically capture additional packages after a rule triggers.
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1